CWE-209 Generation of Error Message Containing Sensitive Information
baseThe product generates an error message that includes sensitive information about its environment, users, or associated data.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (938)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-47813US | —OT critical | KEV | ||
loginok.html in Wing FTP Server before 7.4.4 discloses the full local installation path of the application when using a long value in the UID cookie. | ||||
| CVE-2024-29059US | —OT critical | KEV | ||
.NET Framework Information Disclosure Vulnerability | ||||
| CVE-2013-7331US | medium4.3OT critical | KEV | ||
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostn… | ||||
| CVE-2021-22145US | medium6.5 | Exploit | ||
A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submi… | ||||
| CVE-2025-62168US | high7.5 | Exploit | ||
Squid is a caching proxy for the Web. In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. The vulne… | ||||
| CVE-2010-3332US | medium6.4 | Exploit | ||
Microsoft .NET Framework 1.1 SP1, 2.0 SP1 and SP2, 3.5, 3.5 SP1, 3.5.1, and 4.0, as used for ASP.NET in Microsoft Internet Information Services (IIS), provides detailed error codes… | ||||
| CVE-2014-3566US | low3.4OT high | Exploit | ||
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain clear… | ||||
| CVE-2002-0654US | medium5.0 | Exploit | ||
Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to determine the full pathname of the server via (1) a request for a .var file, which leaks the pathn… | ||||
| CVE-2007-3290US | high9.3 | Exploit | ||
categoria.php in LiveCMS 3.4 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the cid parameter, which reveals the path in a forced… | ||||
| CVE-2018-17961US | high8.6 | Exploit | ||
Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup. NOTE: this issue exists because of an incom… | ||||
| CVE-2001-0986US | medium5.0 | Exploit | ||
SQLQHit.asp sample file in Microsoft Index Server 2.0 allows remote attackers to obtain sensitive information such as the physical path, file attributes, or portions of source code… | ||||
| CVE-2009-0815US | medium5.0 | Exploit | ||
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an e… | ||||
| CVE-2002-2007US | medium5.0 | Exploit | ||
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneou… | ||||
| CVE-2020-15478US | high7.5 | Exploit | ||
The Journal theme before 3.1.0 for OpenCart allows exposure of sensitive data via SQL errors. | ||||
| CVE-2006-6460US | high10.0 | — | ||
Yourfreeworld.com Short Url & Url Tracker Script allows remote attackers to obtain sensitive information via an invalid id parameter to login.php, which leaks the path in an error… | ||||
| CVE-2002-2006US | medium5.0 | Exploit | ||
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via t… | ||||
| CVE-2019-7644US | critical9.8 | — | ||
Auth0 Auth0-WCF-Service-JWT before 1.0.4 leaks the expected JWT signature in an error message when it cannot successfully validate the JWT signature. If this error message is prese… | ||||
| CVE-2019-7612US | critical9.8 | — | ||
A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configu… | ||||
| CVE-2018-14925US | critical9.8 | — | ||
Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components. | ||||
| CVE-2018-11325US | critical9.8 | — | ||
An issue was discovered in Joomla! Core before 3.8.8. The web install application would autofill password fields after either a form validation error or navigating to a previous in… | ||||
04
attack patterns (4)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan